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AMENDMENTS TO THE CLAIMS 

This listing of claims replaces all prior versions, and listings, of claims in the application: 
Listing of Claims: 

1. (Currently Amended) At a requesting computing system that is communicatively 
connectable to a providing computing system, the requesting computing system including 
requesting instructions that can attempt to interact with a providing application at the providing 
computing system, a method for providing information that can be used to verify measurable 
aspects of the requesting computing system, the method comprising: 

an act of performing at lea s t one of determining that the providing computing 
system is appropriately configured to issue challenges to components included in the 
requesting computing system; and 

determining that the providing application is appropriately configured to issue 
challenges to the requesting instructions; 

an act of subsequently acc e pting receiving a challenge that was initiated by the 
providing applicatio n, the challenge including information indicating how the requesting 
computing system is to prove that the requesting computing system is appropriately 
configured to access a resource; based at least in part on the providing computing system 
and the providing application being appropriately configured to issue challenges to the 
requesting instructions; 

formulating proof , based on a measurable aspect of the requesting computing 
system's configuration, that the measurable aspect of the requesting computing system's 
configuration is appropriate for accessing a resource; and 
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an act of submitting an assertion that-that can be used to verify that the requesting 
instructions are computing system is appropriately configured to access a resource, m 
accordance with one or more m e asurable aspects that are appropriat e for interacting with 
the providing application. 
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2. (Currently Amended) The method as recited in claim 1, wherein determining that 
the providing computing system is appropriately configured to issue challenges to components 
included in the requesting computing system comprises an act of establishing an Secure Sockets 
Layer ( SSL) connection between the requesting computing system and the providing computer 
system. 

3. (Original) The method as recited in claim 1, wherein the act of determining that 
the providing application is appropriately configured to issue challenges to the requesting 
instructions comprises receiving proof that the providing application complies with one or more 
security and trust policies of the requesting computing system. 

4. (Currently Amended) The method as recited in claim 1, wherein the act of 
subsequently acc e pting receiving a challenge that was initiated by the providing application 
comprises an act of subsequ e ntly accepting receiving a request for proof of the values of one or 
more measurable aspects of the requesting computer system. 

5. (Original) The method as recited in claim 1, wherein the submitted assertion 
includes the values of one or more measurable aspects of the requesting computer system. 

6. (Original) The method as recited in claim 1, wherein the submitted assertion 
indicates the identity of one or more portions of the requesting instructions. 
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7. (Original) The method as recited in claim 1, wherein the act of submitted 
assertion indicates an execution environment of the requesting code. 
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8. (Currently Amended) At a providing computing system that is communicatively 
connectable to a requesting computing system, the providing computing system including a 
providing application that can attempt to interact with a requesting instructions at the requesting 
computing system, a method for verifying measurable aspects of the requesting computing system, 
the method comprising: 

an act of p e rforming at l e ast one of proving that the providing computing system is 
appropriately configured to issue challenges to components of the requesting computing 
system; and proving that th e providing application is appropriat e ly configured to issue 
challenges to th e requesting instructions; 

an act of subsequ e ntly causing a configuration challenge to be issued to the 
requesting instructions , the challenge including information indicating how the requesting 
computing system is to prove that the requesting computing system is appropriately 
configured to access a resource : 

an act of receiving an assertion that can be used to verify that the requesting 
instructions are configured in accordance with one or mor e measurabl e aspects that ar e 
appropriately for interacting with the providing application , the assertion including 
information based at least in part upon both a measurable aspect of the requesting system is 
configured and the information indicating how the requesting computing system is to prove 
that the requesting computing system is appropriately configured, - r-and 
an act of validating th e assertion.^ 
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9. (Currently Amended) The method as recited in claim 8, wherein the act of proving 
that the providing computing system is appropriately configured to issue challenges comprises an 
act of establishing an Secure Sockets Layer ( SSL) connection between the providing computing 
system and the requesting computing system. 
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10. (Original) The method as recited in claim 8, wherein the act of proving that the 
providing application is appropriately configured to issue challenges to the requesting instructions 
comprises an act of sending proof that the providing application complies with one or more 
security and trust policies of the requesting computing system. 

1 1 . (Currently Amended) The method as recited in claim 8, wherein the act of 
subsequently causing a challenge to be issued to the requesting computing system comprises an act 
of requesting proof of the values of one or more measurable aspects of the requesting computer 
system. 

12. (Currently Amended) The method as recited in claim 8, wherein th e act of 
receivin g an assertion proof that the requ e sting instructions ar e appropriately configur e d for 
accessing the resourc e comprises an act of receiving proof of the identity of one or more portions 
of the requesting instructions. 

13. (Currently Amended) The method as recited in claim 8, wherein th e act of 
receiving an assertion proof that the requesting instructions are — appropriately configured for 
accessing the resource comprises an act of receiving proof of the values of one or more measurable 
aspects of an execution environment at the requesting computer system. 
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14. (Currently Amended) At a computing system that is communicatively connectable 
to a network, a method for generating a challenge and pre-computing answers to the challenge, the 
method comprising: 

an act of accessing a first random value; 
an act of accessing a secret value; 

an act of using the first random value and the secret value as input to a first hash 
algorithm to generate a second random value; 

an act of using the first random value and the second random value as input to a 
second hash algorithm to identify one or more regions within a portion of instructions; 

an act of retrieving values from the identified regions; and 

an act of pre-computing an answer to the challenge based on the retrieved values. 

15. (Original) The method as recited in claim 14, wherein the act of accessing a 
first random value comprises an act of accessing a seed nonce. 

16. (Original) The method as recited in claim 14, wherein the act using the first 
random value and the secret value as input to a first hash algorithm to generate a second random 
value comprises using a seed nonce and the secret to generate a challenge nonce. 

17. (Currently Amended) The method as recited in claim 14, wherein the act of using 
the first random value and the second random value as input to a second hash algorithm to identify 
one or more regions within a portion ofjnstructions comprises an act of using a seed nonce and a 
challenge nonce as input to the second hash algorithm to generate a random bit stream. 
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18. (Original) The method as recited in claim 14, wherein the portion of 
instructions comprises a plurality of identified regions. 

19. (Currently Amended) The method as recited in claim 14, wherein the computing 
system includes a challenge service, further comprising: 

an act of receiving a request for a challenge that a provider can subsequently issue 
to a requester; and 

an act of returning the identified one or more regions within a portion of 
instructions and the values retrieved from the identified regions to the provider. 

20. (Original) The method as recited in claim 14, wherein the computing system 
includes a challenge service, further comprising: 

an act of receiving a response that was submitted to a provider as a response to a 
challenge generated by the challenge service, reception of the response indicating that the 
response was not a pre-computed answer to the challenge; 

an act of verifying the response; and 

an act of indicating to the provider that the response is valid. 
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21. (Currently Amended) At a requester that is communicatively connectable to a 
provider, a method for authorizing the requester to interact with the provider, the method 
comprising: 

an act of sending a request to the provider; 

an act of receiving a configuration challenge from the provider, the configuration 
challenge including information indicating how the requester is to prove that the requester 
is appropriately configured to interact with the provider; 

formulating proof based on a measurable aspect of the requester's configuration, 
that the measurable aspect of the requesting computing system's configuration is 
appropriate for accessing a resource; 

an act of sending proof of the values of one or more measurable aspects of the 
requester to the provider; and 

an act of receiving a token that can be used to prove that the requester is 
appropriately configured. 

22. (Original) The method as recited in claim 21, wherein the act sending a request 
to the provider comprises an act of sending a challenge along with the request, the challenge 
indicating how the provider is to prove that the provider is appropriately configured to issue 
configuration challenges to the requester. 
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23. (Original) The method as recited in claim 21, wherein the act of receiving a 
configuration challenge from the provider comprises an act receiving a configuration challenge 
along with proof that the provider is appropriately configured to issue configuration challenges to 
the requester. 

24. (Original) The method as recited in claim 21, wherein the act of sending proof 
of the values of one or more measurable aspects of the requester to the provider comprises an act 
of sending a challenge along with the proof of the values of one or more measurable aspects, the 
challenge indicating how the provider is to prove that the provider is appropriately configured to 
issue configuration challenges to the requester. 

25. (Original) The method as recited in claim 21, wherein an act of receiving a 
token comprises an act of receiving a token along with proof that the provider is appropriately 
configured to issue configuration challenges to the requester. 
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26. (Original) At a provider that is communicatively connectable to a requester, a 
method for authorizing the requester and the provider to interact with the provider, the method 
comprising: 

an act of receiving a request from the requester; 

an act of causing a configuration challenge to be issued to the requester, the 
configuration challenge requesting proof that the requester is appropriately configured to 
interact with the provider; 

an act of receiving proof of the values of one or more measurable aspects of the 
requester's configuration; and 

an act of sending a token that can subsequently be used to prove that the requester 
is appropriately configured. 

27. (Original) The method as recited in claim 26, wherein the an act of receiving a 
request comprises an act of receiving a challenge along with the request, the challenge requesting 
proof that the provider is appropriately configured to issue configuration challenges to the 
requester. 

28. (Original) The method as recited in claim 26, wherein the act of causing a 
configuration challenge to be issued to the requester comprises an act of sending a configuration 
challenge along with proof that the provider is appropriately configured to issue configuration 
challenges to the requester. 
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29. (Original) The method as recited in claim 26, wherein the act of receiving proof of 
the values of one or more measurable aspects of the requester's configuration comprises an act of 
receiving a challenge along with the proof of the values of the one or more measurable aspects, the 
challenge requesting proof that the provider is appropriately configured to issue configuration 
challenges to the requester. 

30. (Original) The method as recited in claim 26, wherein that act of sending a token 
comprises sending a token along with proof that the provider is appropriately configured to issue 
configuration challenges to the requester. 
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31. (Currently Amended) A computer program product for use in a computing system 
that is communicatively connectable to a network, the computer program product for 
implementing a method for generating a challenge and pre-computing answers to the challenge, 
the computer program product comprising one or more computer-readable physical storage media 
having stored thereon computer-executable instructions that, when executed by a processor, 
processed, cause the computing system to perform the method of claim 14. following: 
access a first random valu e ; 

acc e ss a secret valu e ; 

us e th e first random value and the s e cret valu e as input to a first hash algorithm to 

g e n e rat e a second random valu e ; 

us e the first random valu e and the second random valu e as input to a second hash 

algorithm to identify one or more regions within a portion instructions; 

retri e v e values from th e identified r e gions; and 

pre compute an answ e r to th e challeng e based on th e retriev e d values. 
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32. (Currently Amended) A computer program product for use in a computing system 
having a requester that is communicatively connectable to a provider, the computer program 
product for implementing a method for authorizing the requester to interact with the provider, the 
computer program product comprising one or more computer-readable physical storage media 
having stored thereon computer-executable instructions that, when executed by a processor, 
proc e ssed, cause the computing system to perform the method of claim 21. following: 

send a requ e st to the provider; 

rec e iv e a configuration challenge from the provider, the configuration challenge 

indicating how the requ e ster is to prove that the requ e ster is appropriat e ly configured to 

interact with th e provid e r; 

s e nd proof of th e values of one or more m e asurable asp e cts of th e requ e ster to the 

provider; and 

r e ceiv e a token that can b e used to prov e that th e r e qu e st e r is appropriately 
configur e d. 
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33. (Currently Amended) A computer program product for use in a computing system 
having a provider that is communicatively connectable to a requester, the computer program 
product for implementing a method for authorizing the requester and the provider to interact with 
the provider, the computer program product comprising one or more computer-readable physical 
storage m edia having stored thereon computer-executable instructions that, when executed by a 
processed, cause the computing system to perform the method of claim 26. following: 
r e ceiv e a r e quest from th e requ e ster; 

caus e a configuration challeng e to b e issued to th e r e quester, the configuration 
challeng e r e qu e sting proof that th e r e quester is appropriately configured to int e ract with th e 

r e ceive proof of th e values of one or more measurabl e aspects of the r e quester's 
configuration; and 

s e nd a token that can subsequ e ntly b e used to pr ov e that the requester is 
appropriat e ly configur e d. 
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